Incidents

Toufan

Review this actor's tracked leak-site claims, published reporting, and attributed threat evidence.

ransomware40 leak-site claims, all timeLatest observed leak-site post 2026-01-06

ORKL search ↗

Portable threat brief

Toufan

Facts from stored data only; no AI-written text.

Opens the browser print dialog; choose Save as PDF.

Executive facts

Actor: Toufan
Kind: ransomware
Latest observed: 2026-01-06
Leak-site claims: 40
Catalogued techniques: 0

Scope

Tracked sectors: Construction & Engineering, Legal, Aerospace & Defense, Insurance, Hospitality
Claim records: 2025-09-03 to 2026-01-06

Vulnerability events linked to this group

No dated vulnerability events are attached to this group's linked vulnerabilities.

Verified techniques

No verified ATT&CK mapping for this group.

Defensive actions

No defensive actions are attached to this profile.

Most-claimed sectorsConstruction & EngineeringLegalAerospace & DefenseInsuranceHospitality

Activity window in this site's data

This is only the dates observed by this site. It is not this actor's lifetime or evidence of dormancy outside these dates.

Claim records: First observed 2025-09-03Latest observed 2026-01-06

Verified ATT&CK phases represented

No verified ATT&CK mapping for this group

Origin and motivation

Origin and motivation not attributed.

No MITRE ATT&CK group mapping exists for this actor yet. Mappings here are strict: an actor links to a MITRE group only when the group's own name, aliases, or MITRE-published description match, and MITRE has not catalogued this group. Technique and defensive action data will appear automatically if a verified mapping lands.

Claims posted under this group's name or leak-site brand

40 on this site

ILDefenseLeaks : Optum Industrial Engineering Systems – https://optum-ies.comHealthcare2026-01-06source ↗
ILDefenseLeaks : UPC Precision Castings Ltd – “upccastings.com”Manufacturing2025-12-12source ↗
ILDefenseLeaks : Saar Engineering – “saarengineer.com”Construction & Engineering2025-12-10source ↗
ILDefenseLeaks : CR Casting, Exact LTD and Tefen Metal CastingsManufacturing2025-11-28source ↗
ILDefenseLeaks : Maya Engineering – “maya-il.com”Aerospace & Defense2025-10-30source ↗
Operation – “Enter Upon Them By The Gate” – 0x08 : Gavriel Machal Law FirmLegal2025-10-04source ↗
Operation – “Enter Upon Them By The Gate” – 0x09 : . IZHAR ENGINEERING SERVICES LTD.Construction & Engineering2025-10-04source ↗
Operation – “Enter Upon Them By The Gate” – 0x10 : THE PHOENIXInsurance2025-10-04source ↗
Operation – “Enter Upon Them By The Gate” – 0x11 : exposing 20 complicit law firmsLegal2025-10-04source ↗
Operation – “Enter Upon Them By The Gate” – 0x12 : Zevulun Marine Systems LTDTransportation & Logistics2025-10-04source ↗

View all on Breaches →

Leak-site claim activity

Claims per month, 2025-09 to 2026-01. Peak 20 in 2025-09.

2025-092026-01

Show monthly counts as a table

Month	Claims
2025-09	20
2025-10	16
2025-11	1
2025-12	2
2026-01	1

0 additional claims without a disclosure date

Ransomware claim data is unverified: RansomLook (CC BY 4.0).